fix(@angular/build): add CSP nonce attribute to script tags when inline critical CSS is disabled

alan-agius4 · alan-agius4 · commit a5d6c2bbc2b2 · 2024-07-26T08:02:28.000Z
Prior to this change when inline critical CSS is disabled CSP `nonce` was not added to script tags. Closes #28102
diff --git a/packages/angular/build/src/utils/index-file/index-html-generator.ts b/packages/angular/build/src/utils/index-file/index-html-generator.ts
@@ -78,6 +78,8 @@ export class IndexHtmlGenerator {
       this.csrPlugins.push(inlineCriticalCssPlugin(this));
     }
 
+    this.csrPlugins.push(addNoncePlugin());
+
     // SSR plugins
     if (options.generateDedicatedSSRContent) {
       this.ssrPlugins.push(addEventDispatchContractPlugin(), addNoncePlugin());

Original file line number	Diff line number	Diff line change
`@@ -78,6 +78,8 @@ export class IndexHtmlGenerator {`
`78`	`78`	`this.csrPlugins.push(inlineCriticalCssPlugin(this));`
`79`	`79`	`}`
`80`	`80`
	`81`	`+ this.csrPlugins.push(addNoncePlugin());`
	`82`	`+`
`81`	`83`	`// SSR plugins`
`82`	`84`	`if (options.generateDedicatedSSRContent) {`
`83`	`85`	`this.ssrPlugins.push(addEventDispatchContractPlugin(), addNoncePlugin());`